1. Field of the Invention
The present invention relates to an emergency core cooling system for a boiling water reactor.
2. Related Art
In a boiling water reactor (BWR), an emergency core cooling system (referred to an ECCS hereinafter) is provided.
The ECCS has space regions for safety design called safety divisions and is protected against anticipated fire, flooding, and so on in a plant, by isolating the safety divisions to each other with physical separations (fire walls and watertight walls) so as to isolate the influence of the anticipated events occurring in another division.
Generally speaking the ECCS has two to four safety divisions. In each division, a plurality of motor-driven systems are equipped, and electric power is supplied to the plurality of the motor-driven systems in the division from an emergency power supply source equipped in each safety division.
In the safety standards applied to the ECCS design, a single failure criterion called N+1 safety criterion is included.
During safety assessment on a loss of coolant accident (LOCA) that is a design basis accident (DBA), the N+1 safety criterion requires at least sufficient cooling of a core and a containment even when one system of the ECCS is disabled due to failure.
On the other hand, N+2 safety criterion requires sufficient cooling of the core and the containment even when two safety divisions are lost, by assuming not only a single failure but also maintenance during operation of the nuclear power plant (online maintenance).
The online maintenance is enabled by complying with the N+2 safety criterion, thereby largely contributing to the reduction in shutdown duration of the nuclear power plant and the safety improvement during the shutdown of the nuclear power plant.
An example of the ECCS in German BWR72 meeting the N+2 safety criterion will be described with reference to FIGS. 10 and 11.
FIG. 10 is a division diagram showing the ECCS configuration in German BWR72 meeting the N+2 safety criterion.
The ECCS, having three safety divisions, includes a high pressure core injection system (HPCI) 40a, a low pressure core injection system (LPCI) 41a, a residual heat removal system (RHR) 42a, and an emergency diesel generator (EDG) 43a for each safety division.
Since a pump and part of piping are shared with the low pressure core injection system 41a and the residual heat removal system 42a, they are indicated as LPCI41a/RHR42a in FIG. 10.
FIG. 11 is a drawing showing an ECCS configuration in one safety division. In each of the three safety divisions of FIG. 10, the same ECCS as that in the safety division of FIG. 11 is provided.
Water in a suppression pool 13 that is installed in a containment 15 serving as a water source is sucked and pressurized by pre-stage booster pump 45.
In the high pressure core injection system (HPCI) 40a, the pressurized water by the pre-stage booster pump 45 is further pressurized by an HPCI pump 46 and injected into a reactor pressure vessel 14.
In the low pressure core injection system (LPCI) 41a, the pressurized water by the pre-stage booster pump 45 is injected into the reactor pressure vessel 14 after being cooled in an RHR heat exchanger 47 and led to the feed water piping by an LPCI pump 48.
The German BWR72 is designed so that the number of safety divisions N required for a design basis accident is to be 1 and is composed of three safety divisions in total by adding two divisions thereto on the assumption that a single failure occurs and the online maintenance is performed.
Because each residual heat removal system 42a has 100% of the required heat removal capacity at the loss of coolant accident, which is the design basis accident, even if two safety divisions are lost due to a single failure and the online maintenance, respectively, the core and the containment can be cooled with the residual one safety division. That is the reason why the three safety division configuration can be adopted.
The German BWR72 has no reactor core isolation cooling system (RCIC) that is a turbine-driven system to maintain the core water level at transient. Therefore, if the nuclear reactor is isolated due to the loss of offsite power supply, and furthermore, if all the three emergency diesel generators 43a fail, i.e., an event of loss of the whole AC power supply source (referred to SBO below), occurs, the reactor core cannot be entirely cooled.
On the other hand, an example of the ECCS in Swedish BWR75 meeting the N+2 safety criterion will be described with reference to FIG. 12.
FIG. 12 is a division diagram showing the ECCS configuration in Swedish BWR75 meeting the N+2 safety criterion.
The ECCS, having four safety divisions, includes an auxiliary feed water system (AFS) 50b, a low pressure core injection system (LPCI) 41b or a low pressure core spray system (LPCS) 51b, a wet well and dry well cooling system (WDCS) 52b, and an emergency diesel generator (EDG) 43b for each safety division.
Since the residual heat removal system (RHR) is dedicatedly used as the wet well and dry well cooling system 52b for cooling a wet well and a dry well of the containment at a design basis accident, it is indicated as WDCS 52b in FIG. 12.
The low pressure core injection system 41b or the low pressure core spray system 51b and the residual heat removal system (the wet well and dry well cooling system) 52b are independently provided without sharing a pump unlike the LPCI pump 48 of the German BWR72.
The auxiliary feed water system (AFS) 50b is not provided for the purpose of the emergency core cooling, so that it does not have a sufficient capacity for cooling the core at the loss of coolant accident (LOCA) that is a design basis accident. Therefore, two systems of the AFS 50b in total are necessary to fulfill the injection to make up the coolant corresponding to the decay heat and the injection to make up the core at a small LOCA.
On the other hand, the low pressure core injection system (LPCI) 41b and the low pressure core spray system (LPCS) 51b have 100% of the cooling capacity per unit system required for cooling the reactor core at a piping breakage accident of the emergency core cooling system.
The wet well and dry well cooling system (WDCS) (the residual heat removal system) 52b is dedicated to cool the containment and does not have a function to inject water into the reactor core.
The Swedish BWR75 is designed so that the number of safety divisions N necessary for a design basis accident is 2 and is composed of four safety divisions in total by adding two divisions thereto on the assumption that a single failure occurs and the online maintenance is performed.
The reason why the four safety divisions are necessary is that if a combination of a single failure in the first safety division, online maintenance in the second safety division, and a loss of coolant accident in the third safety division due to a self-pipe break of the low pressure core injection system 41b or the low pressure core spray system 51b is assumed, it is realized that a fourth safety division having a function to inject water into the reactor core is required.
Further, on the basis of the above, a residual heat removal system 42b is designed to have 50% of the cooling capacity, per unit system, of the heat removal amount required for cooling the reactor core and the containment at the loss of coolant accident (LOCA), which is the design basis accident.
However, the Swedish BWR75 has no reactor core isolation cooling system (RCIC) in the same way as in the German BWR72. Hence, at the event of the loss of the whole AC power supply source (SBO), that is the reactor is isolated due to the loss of offsite power supply, and the entire four emergency diesel generators 43b are disabled due to common cause failure, the reactor core cannot be cooled.
Furthermore, as an improved version of the BWR, an advanced BWR (referred to ABWR hereinafter) is provided.
The ABWR enhances the safety performance of the ECCS much more than that of a conventional BWR while cost is minimized by dividing the ECCS into three divisions.
FIG. 13 is a diagram showing a division configuration of the ECCS in the ABWR.
Referring to FIG. 13, a low pressure core cooling system (LPFL) 61c, a residual heat removal system (RHR) 42c, and an emergency diesel generator (EDG) 43c are provided for each safety division. In the first and second safety divisions, a high pressure core cooling system (HPCF) 60c is provided, and at the third safety division, a reactor core isolation cooling system (RCIC) 62c is equipped.
Since a piping and a portion of a pump are shared with the low pressure core cooling system 61c and the residual heat removal system 42c, they are indicated as LPFL61c/RHR42c in FIG. 13.
The high pressure core cooling system (HPCF) 60c has a capacity sufficient for cooling the reactor core and avoiding the uncovery of the reactor core against entire range of loss of coolant accidents from the low pressure to the high pressure with one system. Hence, even on the assumption of a loss of coolant accident due to the self pipe break of the low pressure core cooling system 61c within the same safety division, the submergence of the reactor core can be maintained with only one system that is the high pressure reactor core cooling system 60c. 
The residual heat removal system (RHR) 42c has 50% of the cooling capacity, per unit system, of the heat removal amount required for cooling the reactor core and the containment at the loss of coolant accident (LOCA), which is the design basis accident.
The reactor core isolation cooling system (RCIC) 62c is a turbine-driven pump system using the reactor steam supplied from the reactor vessel, so that an AC power source is not required. Therefore, even when the SBO occurs, the system is designed to sufficiently cool the reactor core. Further, the reactor core can be cooled for about 8 hours after the SBO occurs.
The ECCS of the ABWR has very high reliability and the full-time online maintenance is not necessary, so that the system is designed in compliance with the N+1 safety criterion on the assumption of only a single failure.
On the other hand, an ESBWR (economic and simplified BWR (referred to ESBWR hereinafter) is an example of having the ECCS composed of only passive safety systems (Japanese Unexamined Patent Application Publication No. 2007-10457, for example: Patent Publication 1).
FIG. 14 shows the ECCS configuration of the ESBWR.
The ECCS of the ESBWR shown in FIG. 14 includes an isolation condenser (IC) 65 placed on the containment 15 and composed of an upper cooling water pool and a heat exchanger placed thereon, a passive containment cooling system (PCCS) 67, and a gravity-driven cooling system (GDCS) 66 having a GDCS pool 68 arranged in the containment 15.
The isolation condenser (IC) 65 takes in the reactor steam directly from the reactor vessel 14 so as to again inject the condensate into the reactor vessel 14 by the gravity after cooling and condensing the steam by the heat exchanger. This is an equivalent function corresponding to the reactor core isolation cooling system (RCIC) 62c of the ABWR, and according to this function, the reactor core is cooled when the nuclear reactor is isolated.
The passive containment cooling system (PCCS) 67, at a loss of coolant accident, absorbs the steam discharged into the containment 15 so as to return the condensate to the GDCS pool 68 by the gravity after cooling the steam with the heat exchanger. This is a function corresponding to the residual heat removal system (RHR) 42c of the ABWR.
The gravity-driven cooling system (GDCS) 66, at a loss of coolant accident, injects cooling water in the GDCS pool 68 by the gravity for cooling the reactor core. This is a function corresponding to the low pressure core cooling system 61c of the ABWR.
Since the ECCS of the ESBWR is never using an active component, such as a motor-driven pump, a large-scale emergency power supply, such as an emergency diesel generator, is not at all required. Hence, the reactor core scarcely becomes damaged due to the long term SBO.
Further, since the ESBWR does not need an active secondary system, such as a reactor cooling water system (RCW) and a reactor sea water system (RSW), the ECCS cannot lose the function due to the damage of the active component and have high safety.
On the other hand, in the ESBWR using the gravity to inject water into the reactor core sufficiently, it has been necessary to provide a very long reactor pressure vessel 14 with a height as tall as 27.6 m.
As an example of the ECCS totally ensuring the safety of a nuclear power plant, not by relying only on the passive component like in the ESBWR but by optimally combining the active safety system of the ABWR with the passive safety system of the ESBWR, there is provided a hybrid 3-division ECCS of a TSBWR (Japanese Unexamined Patent Application Publication No. 2006-138680, for example: Patent Publication 2).
FIG. 15 is a diagram showing a division configuration of the ECCS in the TSBWR.
Referring to FIG. 15, in each of first and second safety divisions, an ECCS of an active safety system is provided so as to provide a high pressure core cooling system (HPCF) 60d, a low pressure core cooling system (LPFL) 61d, a residual heat removal system (RHR) 42d, and an emergency diesel generator (EDG) 43d, respectively. Since a pump and a portion of a piping are shared with the low pressure-core cooling system 61d and the residual heat removal system 42d, they are indicated as LPFL61d/RHR42d in FIG. 15.
In a third safety division, an isolation condenser (IC) 65d, a gravity-driven cooling system (GDCS) 66d, and a passive containment cooling system (PCCS) 67d are provided as a passive safety system.
Each ECCS of the TSBWR in the first and second safety divisions has 100% of the cooling capacity required for cooling the reactor core at a loss of coolant accident that is a design basis accident. Namely, the active safety system is designed so as to satisfy the N+1 safety criterion alone.
However, since the ECCS in the third safety division also has 100% of the cooling capacity required for cooling the nuclear reactor core at a loss of coolant accident that is a design basis accident, the whole ECCS is designed to satisfy the N+2 safety criterion.
Thus, even when the entire functions of the safety divisions for the active safety system are lost, the ECCS of the TSBWR can safely cool the reactor core and the containment with the safety division for the=passive safety system that is quite diverse from the active safety system in the operating mechanism.
A conventional BWR, as typified by the ABWR, has extremely high safety against an internal event generated within a nuclear power plant, and the reactor core damage frequency due to the internal event is as very small as the order of 10−8/reactor•year.
For the extremely safe BWR as described above, an external event is only one residual risk (although the risk level has been already lowered thoroughly and the safety level is sufficiently high in view of engineering, too few risk but it is not reduced to the extent of substantial zero).
The external event herein includes severe natural phenomena such as a giant earthquake and a mega hurricane. It also includes a fire originated not by an event within a nuclear power plant but by an external cause.
In the conventional BWR and ABWR having the ECCS composed only of the active safety system, when a severe natural phenomenon, such as a giant earthquake and a mega hurricane, is generated, the loss of the whole AC power supply event (SBO) continues a long time, so that the reactor core may be damaged.
Specifically, the German BWR72 and the Swedish BWR75 have no reactor core isolation cooling system (RCIC), so that they are designed so as never to cool the reactor core at the SBO.
In the German BWR72, due to the failure of the pre-stage booster pump 45 provided in each safety division, there is the possibility that whole function of one safety division can be lost. Furthermore, since the number of the safety divisions is 3, on the assumption that a fire is generated in a first safety division; a single failure occurs in a second safety division; and the online maintenance is performed in a third safety division, no available safety division exists.
Furthermore, in the Swedish BWR75, since the four residual heat removal systems (the four wet well and dry well cooling systems) 52b are provided in all the safety divisions, the four reactor cooling water systems (RCW) and the four reactor sea water systems (RSW), which are required as a secondary cooling system) are also provided in the four safety divisions, deteriorating the cost efficiency. Further, the four emergency power supply units are provided, increasing the maintenance load.
On the other hand, in the ABWR designed in compliance with the N+1 safety criterion, the maintenance of the ECCS is necessary to be performed during the shutdown of a nuclear power plant, so that the number of the safety divisions may be less against a natural phenomenon generated during this period, which may result in a risk of the reactor core damage due to insufficient cooling of the reactor core.
When the N+2 safety criterion is required, on the assumption that the safety function is lost due to a fire in a first safety division and second and third safety divisions are not available due to a single failure and the online maintenance, respectively, upon being required to shutdown a nuclear power plant due to an external fire that is an external event, there is no residual functioning safety division so that the nuclear reactor cannot be safely shutdown.
When the SBO is generated, although the cooling of the reactor core is possible for about 8 hours by the reactor core isolation cooling system, if the SBO continues for a longer period, the reactor core might not be cooled.
In the ESBWR having the ECCS composed of only the passive safety system, since its operation does not require an external power supply system, an emergency power supply, and a RCW, if a severe natural phenomenon is generated, the high safety has been secured owing to the passive safety system.
However, during the refueling of the nuclear power plant, since the reactor pressure vessel 14 and the containment 15 are opened, almost all the passive safety systems are not available due to the loss of the steam buoyancy and the pressure difference in the containment 15 serving as driving force.
Thus, against a natural phenomenon generated during the refueling of the nuclear power plant, there is little effective safety equipment, deteriorating the safety.
Furthermore, although the ESBWR is provided with a shutdown cooling system (SCS) (not shown) for removing the residual heat from the reactor core during the refueling of the nuclear power plant, the shutdown cooling system could not respond to a natural phenomenon because it is a non-safety system.
In addition, in the TSBWR having the ECCS composed of the active safety system and the passive safety system, during the operation of the nuclear power plant, extremely high safety can be secured against the natural phenomenon owing to the passive safety system.
However, since the TSBWR only has the number of the safety divisions for the active safety system to a required minimum, during the shutdown of the nuclear power plant where the passive safety system is not available, the number of the safety divisions of the active safety system is insufficient, so that if a natural phenomenon is generated, the reactor core might be damaged.
Furthermore, for relying on the function of the gravity-driven cooling system 66d, a long reactor pressure vessel with a large height has been required. Unless it is provided, the online maintenance is impossible because of the insufficient cooling function of the gravity-driven cooling system 66d. 
In addition, since the number of the safety divisions is 3, on the assumption that a single failure is generated, i.e., the emergency diesel generator 43d is failed in a first safety division; the online maintenance of the emergency diesel generator 43d is performed in a second safety division; and a fire is generated in a third safety division, there is no residual functioning safety division for safely shutdown the nuclear reactor.